SUSE-SU-2026:21141-1 Security update for cockpit-packages

This update for cockpit-packages fixes the following issue: Update cockpit-packages to version 4: - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string bsc1258641. Changes for cockpit-package...

Linux Distros Unpatched Vulnerability : CVE-2026-35580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled...

RockyLinux 9 : opencryptoki (RLSA-2026:5603)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:5603 advisory. openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following CVE-2026-23893 Tenable has extracted the preceding description block...

RockyLinux 9 : rsync (RLSA-2026:6390)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6390 advisory. rsync: Rsync: Out of bounds array access via negative index CVE-2025-10158 Tenable has extracted the preceding description block directly from the RockyLinux...

Oracle Linux 10 : rsync (ELSA-2026-6825)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-6825 advisory. - Resolves: RHEL-152885 - CVE-2025-10158 Out of bounds array access via negative index Tenable has extracted the preceding description block directly from the...

RockyLinux 9 : python3.12 (RLSA-2026:6285)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6285 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-34444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed throug...

Linux Distros Unpatched Vulnerability : CVE-2026-28388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number...

CVE-2026-34043 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards-fips, sqlpad, opensearch-dashboards, argo-workflows, arangodb, gitlab-rails-ce-fips, tileserver-gl, librechat, drupal, gitlab-rails-ce, tileserver-gl-fips, wazuh-dashboard-fips, kubeflow-katib...

PYSEC-2026-158

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates systempackages directly into a...

@ablehi/automation-app-build (>=0.1.0, <=0.1.22), @ablehi/automation-app-cli (>=0.1.0, <=0.1.22) +144 more potentially affected by CVE-2026-39365 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.1.0, =0.1.0, =0.0.0-experimental-04f2240-20260306-7fcde375, =0.0.0-experimental-fd6d426-20260301-87c73ec5 and more Source cves: CVE-2026-39365 Source advisory:...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +88 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: OSV:GHSA-36XV-JGW5-4Q75...

CVE-2026-35175 Ajenti has an authorization bypass during custom package installation

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15...

CVE-2026-35175

Ajenti (Linux/BSD modular server admin panel) contains an authorization bypass vulnerability (CVE-2026-35175) where an authenticated user using the auth_users method could install a custom package even without superuser privileges. Red Hat/NVD entries confirm the issue and that it is fixed in ver...

CVE-2026-35175 Ajenti has an authorization bypass during custom package installation

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15...

MGASA-2026-0084 Updated xz packages fix security vulnerability

Buffer overflow in lzmaindexappend. CVE-2026-34743...

Updated xz packages fix security vulnerability

Buffer overflow in lzmaindexappend. CVE-2026-34743...

CVE-2026-35043 BentoML: command injection in cloud deployment setup script (deployment.py)

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates systempackages directly into a...

GHSA-G68W-W4H2-FR59 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-QV7J-4883-HWH7 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, gitlab-rails-ce-fips, pact-broker-docker, pact-broker-docker-fips, ruby3.2-rack, ruby3.2-rails, ruby3.3-rack, ruby3.4-rack, ruby3.4-rails, gitlab-rails-ce, logstash, gitlab-cng, kube-fluentd-operator...